A use-after-free vulnerability in the Linux kernel NVMe driver was fixed related to the character device (cdev) lifetime management. The issue occurs in multipath mode when the namespace head is torn down, causing open cdev file operations to reference freed memory, leading to a kernel crash detected by KASAN. This flaw allows referencing a freed nvme_ns_head structure after its reference count drops to zero.
CVE-2026-98789 addresses a memory management issue in the Linux kernel's BPF subsystem where objects can become stuck in the free_by_rcu_ttrace list due to improper handling of RCU callbacks. This can cause unbounded accumulation of such objects, potentially impacting system resource management. The vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.6.
CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
CVE-2026-98717 is a vulnerability in the Linux kernel's KVM x86 memory management unit (mmu) subsystem. It occurs when shadow page table walks continue despite the root being invalid or a dummy root, leading to a NULL pointer dereference and kernel crash. This happens if memslot creation races with a stage-2 page fault, causing KVM to use the zero page incorrectly. The issue has been resolved by terminating shadow walks immediately when encountering a dummy root, preventing the NULL pointer dereference.
CVE-2026-98706 is a high-severity vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem. It involves improper handling of power-save (PS) delivery work during the teardown of a station (AP or mesh). The flaw allows a delayed worker to continue processing after the station has been marked dead and removed, potentially causing inconsistent driver state and queue management.
A vulnerability in the Linux kernel's mac80211 wifi subsystem allowed proxy path management to bypass the mesh path limit, potentially leading to exceeding the maximum allowed mesh paths. This was due to incorrect accounting of proxy paths against the mesh path limit, which could cause the interface path counter to become negative and allow more mesh paths than intended. The issue has been resolved by properly reserving and releasing quota for proxy paths, enforcing a shared 1024-entry budget for mesh and proxy paths.
A vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel activation callback handling has been resolved. The issue involved an optional callback that, if not provided, caused a reference leak for every tunnel without a callback. This affected hibernation restore by blocking for up to 12 seconds. The fix makes the DP tunnel activation callback mandatory, removing the synchronous path and ensuring proper reference management and improved hibernation restore performance.
A domain reference leak vulnerability in the Linux kernel's Thunderbolt driver was fixed. The issue occurs when a DisplayPort (DP) tunnel read operation is canceled, causing a domain reference to be leaked and potentially blocking driver unbinding indefinitely. The fix ensures proper reference management by pairing get/put calls within the same file, preventing leaks and blocking.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allows duplicate disable event requests to cause a runtime PM usage count underflow warning. This occurs because repeated disable requests improperly drop a runtime PM reference that was not acquired, potentially leading to incorrect power management state handling.
A vulnerability in the Linux kernel's sun4i-gpadc-iio driver causes improper cleanup when thermal zone registration fails. Specifically, if devm_thermal_of_zone_register() fails, the probe function returns without unregistering the IIO map array or disabling runtime power management, potentially leading to resource leaks.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver caused the iio_device to remain registered after a power management setup failure during device probe. This left sysfs and character device nodes active, pointing to freed memory, potentially leading to use-after-free conditions. The issue has been fixed by ensuring the device is properly unregistered on error paths.
CVE-2026-98632 is a use-after-free vulnerability in the Bluetooth mesh management code of the Linux kernel. It occurs when a mesh transmission is canceled but a queued entry still holds a pointer to the freed transmission object, leading to unsafe memory access. This flaw has been fixed by properly dequeuing pending entries before freeing them and ensuring the transmission queue advances correctly after cancellation or errors.
CVE-2026-98629 is a vulnerability in the Linux kernel's net/sched cls_u32 subsystem where manual hash tables created with explicit handles can cause IDR aliasing. This leads to unreachable IDR entries on deletion, causing permanent resource leaks and potential misrouting of lookups to incorrect tables. The issue arises because manual tables key their IDR entries differently from the destroy paths, causing conflicts in handle management. The vulnerability has been fixed by aligning allocation and removal key domains and rejecting manual handles that alias existing IDs.
CVE-2026-98625 is a use-after-free vulnerability in the Linux kernel's netfilter flowtable subsystem. It occurs because the HW_DEAD flag is published before the worker clears the HW_PENDING flag, allowing concurrent garbage collection to free a flow object prematurely. This flaw has been resolved by reordering the flag updates to ensure safe object lifecycle management.
A vulnerability in the Linux kernel's fbnic network driver involves incorrect use of the Rx queue NAPI pointer to find the NAPI vector. The issue arises when standalone Tx vectors are present, causing the Rx queues to point to Tx NAPI vectors incorrectly. This can lead to improper queue management and potential instability. The fix involves using the correct stored napi pointer from netdev_rx_queue.napi and handling cases where the pointer is NULL to avoid accessing freed resources.
CVE-2026-98560 is a medium-severity vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) networking subsystem. It involves incorrect sizing of a connection's path set based on the transport protocol used, leading to inconsistent resource allocation and deallocation. This flaw occurs because the number of paths is computed before the transport is finalized, causing potential memory management issues during connection teardown. The issue affects specific Linux kernel versions and has been resolved by recomputing the number of paths after the transport is finalized.
A runtime power management (PM) reference leak was fixed in the arizona_gpio_direction_out() function of the Linux kernel's gpio arizona driver. The flaw occurred when switching a persistent GPIO line from input to output: if regmap_update_bits() failed, the runtime PM reference on the parent device was not released, causing a leak. This could lead to resource management issues but does not directly cause code execution or data corruption.
A runtime PM (power management) reference leak occurs in the Linux kernel's gpio: zynq driver due to improper handling of pm_runtime_get_sync() failure. This causes the controller's clock to remain enabled as it cannot runtime-suspend, potentially impacting power efficiency.
A runtime power management (PM) reference leak was fixed in the Linux kernel's amdgpu driver in the function amdgpu_debugfs_test_ib_show(). The issue occurred when the function resumed the device but failed to release the PM reference if acquiring a write lock was interrupted, causing the GPU to remain awake unnecessarily.
A low-severity vulnerability in the Linux kernel's nouveau DRM driver causes a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If nvif_outp_edid_get() fails, the function returns early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by balancing the PM reference on the error path.